Clear path from single Node process to a small replica set behind nginx. The piece that usually bites after HTTPS works is upstream health versus sticky sessions. If the app keeps in-memory session state, round-robin without a shared store looks like random logouts; either terminate sessions at a shared Redis/store or enable a consistent ip_hash/sticky only where you must, and document why.

I also pin proxy_http_version 1.1 plus Connection "" and the usual Host / X-Forwarded-For / X-Forwarded-Proto headers so the Node apps see the public scheme. For load balancing I prefer least_conn once replicas are equal, and I keep max_fails/fail_timeout modest so a crashed container leaves the pool quickly. After compose scale I hit each upstream directly on the docker network and then through nginx, comparing Set-Cookie and latency — mismatches almost always mean the wrong Host or a stale upstream block that was never reloaded.